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Introduction 



HP Integrity servers running Microsoft Windows Server 2003 can be configured to support 
Windows OS kernel debugging. This document provides the software and hardware 
requirements, instructions on how to set up and run the debugging environment, and 
troubleshooting tips and tricks. 

Supported Servers 

• HP zxl chipset: rx2600, rx4640, rx5670 

• HP sxlOOO chipset: rx7620, rx8620, Superdome 

Who Should Use the Microsoft Windows OS Kernel Debugger 

The Windows OS Kernel Debugger is a sophisticated debugging and troubleshooting tool 
intended for use by software and hardware developers and advanced IT support personnel, 
who already understand the inner workings of the Windows OS Kernel. Knowledge of 
operating system and kernel design is a pre-requisite for using the Windows OS Kernel 
Debugger, as it is a detailed, low-level, engineering tool. 

Setting up the Windows OS Kernel Debug Environment 

This section will describe the software, hardware, and set up that is necessary to get the 
Windows OS Kernel Debug Environment operational. 

Hardware Requirements 

1. HP Integrity server (with one or more cell boards installed if sxlOOO-based). 

2. Laptop or workstation with a serial port. 

3. RJ45 to DB9F converter for rx5670, rx7620, rx8620, and Superdome (please see 
Appendices A and B for additional information). 

4. DB9 Female-terminated RS-232 Null Modem Cable for rx2600 and rx4640 (see 
Appendix A for port locations). 

5. A standard 4-pair CAT-5 cable with RJ45 Connectors if using the RJ45 to DB9F 
converter. 

Software Requirements 

1. Microsoft Debugging Tools for Windows package: 

Microsoft Kernel Debugger is downloadable from: 

http://www.microsoft.com/whdc/ddk/debugging/default.mspx 



Please note Microsoft ships a 32-bit debugger client capable of debugging 64-bit 
OS installations, as well as a 64-bit debugger client. The typical configuration is 
to connect a 32-bit laptop or workstation as the debugger client to a 64-bit target 
system. 

2. KD.EFI utility: 

KD.EFI is an HP utility that is downloadable from the www.hp.com website. It can also 
be found on Smart Setup 3.10 or greater. 

Required Steps for Enabling OS Debugging 



Step 


HP Integrity Servers 


Description of 
Procedure 


Operating System 
Run State 




rx2600 


rx4640 


rx5670 


rx7620 
rx8620 


Super 
Dome 












1 


X 


X 


X 


X 


X 


Setting up the 
Hardware 


The OS can be up or 
down. 


2 








X 




Add KD utility to the 
EFI Partition. 


The OS must be up. 


3 


X 


X 


X 


X 


X 


Enabling Live Debug 
in the OS 


The OS can be up or 
down. 

Procedure is simpler 
while the is running. 


4 








X 


X 


Determining the Cell 
to attach the 
debugger to 


The OS can be up or 
down. 

Procedure is simpler 
with OS down. 


5 




X 




X 




Enabling the Kernel 
Debugger Port 


The OS must be 
down for 
rx7620/rx8620. 
Power must be off for 
rx4640. 


6 






X 


X 


X 


Construct the RJ45 
to DB9F adapter. 


N/A 


7 


X 


X 


X 


X 


X 


Attach the Debugger 
to the System 


The OS can be up or 
down. 

Kernel Debugger 
should be attached 
prior to booting the 
OS to see messages. 



The above table shows the optimum path to configure the server for Live Kernel debugging. 
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HP recommends performing steps 4 and 5 with the system down. Since step 3 requires the OS 
to be rebooted for the change to take effect (that is Live Debugging to be enabled) steps 4 and 
5 can be performed during the reboot cycle. 



Setting up the Hardware on rx5670, rx7620, rx8620 and 
Superdome Servers 

Connect the hardware as shown in the diagram below (Fig. 1). The serial port on the Laptop 
or Workstation should connect to the RJ45 to DB9 Converter (see Appendix B for pin-out 
instructions on building a converter). One end of the 4-pair CAT-5 cable should connect to 
the RJ45 to DB9 Connector. The other end of the 4-pair CAT-5 cable should connect to the 
Debug Port as follows: 

• to the rx5670 main board (see Appendix A, Fig. 6 for location) 

• to the Core Cell of a partition in the HP Integrity rx7620 or rx8620 or Superdome 
server (see next sections or Appendix D to find out which Cell is the "Core" Cell, as 
well as a diagram of where the RJ45 connector is located on the Cell board). 



Laptop 
or 

Workstation 



RJ45toD69 
Converter 




+pair CAT-5 



Connect 
to RJ45 



HP Integrity 
Server 



Figure 1 : Setting up the Hardware with an RJ45 adapter. 



Add KD Utility to the EFI Partition (rx7620 and rx8620 only) 

The HP Integrity rx8620 and rx7620 have a Kernel Debugger Port that is shared with a 
Support Debug Port (used by HP field personnel). 

The default state for this shared port is to function as a Support Debug Port, and so it 
normally is not enabled for use as a Windows Kernel Debugger. To enable the port for 
Windows Kernel Debugging, you must use the EFI-based application called KD.EFI. 

KD.EFI must be executed at the EFI shell, and the Operating System must be shut down in 
order to access the EFI shell. However, before that occurs, the utility must be copied to the 
EFI System Partition, which is most easily done in the Windows operating system using the 
command MOUNTVOL.EXE. Administrative privileges are required to use this command. 

For the EFI System Partition to be addressable from the Windows Operating System, a drive 
letter must be identified to use with the EFI System Partition. In the following example 
command, the E drive is used: 

mountvol e : /s 



7 



The /s option mounts the EFI System Partition so the Operating System recognizes it as a 
normal drive. Copy or Drag and Drop operations can be used to copy files. Please note that 
this operation does not mount the EFI System Partition persistently across reboots. 



Setting Up the Hardware on rx2600 and rx4640 Servers 

Connect the hardware as shown in the diagram below (Fig 2.). The serial port on the Laptop 
or Workstation should connect directly to the DB9 port in the back of the server. (See 
Appendix A, Figures 4 and 5 for connector locations.) The required cable is a standard DB9 
Female-terminated RS-232 Null Modem Cable. 




Laptop 
or 

Workstation 




DBSF-DBSF 
null Noderi 



Connect 

to DB9 



HP Integrity 



Figure 2: Setting up the hardware with a DB9 null modem cable. 



Enabling the OS for Live Debugging 

Enabling Debug is done by using the BOOTCFG.EXE utility that is part of the Windows 
2003 Operating System and is very similar to configuring the option in 32-bit Windows. To 
execute BOOTCFG.EXE you must have administrative privileges. 

The only real difference with the HP Integrity server is that there is no COM port specified, 
since the Operating System is already presented with the Cell board' s serial connector as a 
debugging port only. This means that the options that must be specified are the DEBUG and 
BAUD option only. The following example shows how to reconfigure these options on the 
server with the operating system running. An alternative option is to configure Live 
Debugging with the operating system down at the EFI shell. This is discussed in Appendix C. 

The current boot configuration can be listed by typing the following at a command line with 
the Operating System up: 



C: \>bootcfg 



Boot Options 



Timeout: 2 0 

Default : 

\Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolumel\ WINDOWS 
CurrentBootEntrylD : 1 
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Boot Entries 



Boot entry ID: 



1 



OS Friendly Name 
OsLoadOptions : 



Windows Server 2003, Enterprise 
/ redirect 



BootFilePath : 

\Device\HarddiskVolumel\EFI\Microsof t\WINNT50\ia641dr . ef i 
OsFilePath: 

\Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolumel\ WINDOWS 



OS Friendly Name: EFI Shell [Built-in] 

It can be seen from the example above that Boot Option 1 is the default Windows boot 
option, and it only has the Out Of Band management (EMS or SAC prompt) configured as an 
option (the "redirect" option). On some systems the "novesa" option could be listed here too. 
An option must be added to facilitate Live Debugging. 

To enable Live Debugging for the server the preferred method is to make a copy of the boot 
entry, and add the options needed afterwards. Please note, optionally it is possible to then 
move the new debug enabled line to be the default boot option. If the debug entry is made to 
be default, after successful debugging the original boot entry must be moved back to default. 
It is recommended to run debug mode while debugging, and not all the time. 

The next step is to make a copy of the default boot entry by issuing the following command 

C:\>bootcfg /copy /d "Windows Server 2003, Enterprise with 
Debugging Enabled" /id 1 

SUCCESS: Made a copy of the boot entry "1". 

This has copied Boot Entry ID 1 and made it the last entry in the list. In this case, since we 
only have 3 boot entries, the copied Boot Entry will be ID 4, but on other systems with more 
options this would be a different number. The bootcfg command is issued again to show the 
newly added Boot Entry ID 4. 

C: \>bootcfg 

Boot Options 



Timeout: 2 0 



Boot entry ID: 
OS Friendly Name 



2 



Internal Bootable DVD 



Boot entry ID: 



3 
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Default : 

\Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolumel\ WINDOWS 
CurrentBootEntrylD : 1 



Boot Entries 



Boot entry ID: 1 

OS Friendly Name: Windows Server 2003, Enterprise 

OsLoadOptions : /redirect 

BootFilePath: 

\Device\HarddiskVolumel\EFI\Microsof t\WINNT50\ia641dr . ef i 
OsFilePath: 

\Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolumel\WINDOWS 
Boot entry ID: 2 

OS Friendly Name: Internal Bootable DVD 
Boot entry ID: 3 

OS Friendly Name: EFI Shell [Built-in] 
Boot entry ID: 4 

OS Friendly Name: Windows Server 2003, Enterprise with Debugging 
Enabled 

OsLoadOptions: /redirect 
BootFilePath: 

\Device\HarddiskVolumel\EFI\Microsof t\WINNT50\ia641dr . ef i 
OsFilePath: 

\Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolumel\ WINDOWS 



Note Boot Entry 4 is the same as Boot Entry 1 with the exception of the description (OS 
Friendly Name) that is different. 

The Debug and Baud options can now be added to Boot Entry 4 by using the following 
command 



C:\>bootcfg /debug on /baud 115200 /id 4 

SUCCESS: The OS load options have been changed for the BootID: 4. 

Note that the boot entry has been configured for a baud rate of 1 15200. Some laptops may not 
support this speed, in which case a different value such as 38400 can be used. Remember to 
use the same value in the kernel debug application where appropriate. 
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To confirm that the entries were added correctly simply use the bootcfg command again, 
which will show an output similar to the example below. 

C: \>bootcfg 

Boot Options 



Timeout: 2 0 

Default : 

\Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolumel\WI 
NDOWS 

CurrentBootEntrylD : 1 
Boot Entries 



Boot entry ID: 1 

OS Friendly Name: Windows Server 2003, Enterprise 
OsLoadOptions : /redirect 
BootFilePath : 

\Device\HarddiskVolumel\EFI\Microsof t\WINNT50\ia641dr . ef i 
OsFilePath: 

\Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolumel\WINDO 
WS 



Boot entry ID: 2 

OS Friendly Name: Internal Bootable DVD 
Boot entry ID: 3 

OS Friendly Name: EFI Shell [Built-in] 
Boot entry ID: 4 

OS Friendly Name: Windows Server 2003, Enterprise with Debugging 
Enabled 

OsLoadOptions: /redirect /debug /baudrate=115200 
BootFilePath: 

\Device\HarddiskVolumel\EFI\Microsof t\WINNT50\ia641dr . ef i 
OsFilePath: 

\Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolumel\WINDOWS 

Boot Entry ID 4 now shows the debug and baud rate switch. As discussed earlier, a COM 
port entry is not required for HP Integrity servers. 
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Optional Step 



Optionally, the debug boot entry can be configured to be the default boot entry, although 
before implementation this option should be considered very carefully. Every time the system 
is rebooted the debug option is enabled, and this is not desirable for a production system since 
performance will be slightly impaired. Please note HP recommends that the debug option is 
only used for debugging and not installed by default. It can be installed as default 
temporarily, until debugging is completed, but then the original Boot Entry should be 
changed back to default. 

To enable the debug Boot Entry as the default, the following command should be used (again 
the boot entry for the created debug option on the system may be a different ID to the 
example shown below. The example shows the Boot Entry ID as 4) 

C:\>bootcfg /default /id 4 

SUCCESS: The boot entry line "4" has been made as the default boot 
entry . 

The Debug Boot Entry will now be the default. 

Restoring the Original Boot Entry after Optional Step 

The original boot entry will be shifted down to ID 2. To restore Boot Entry ID 2 as the 
default, simply re-issue the above command with an ID of 2, as in this example: 

C:\>bootcfg /default /id 2 

Determining the Core/Root Cell on the HP Integrity sx1000 Servers 

The terms "Core Cell" and "Root Cell" are synonymous with each other. The Partitioning 
Commands that are part of the ParCli product use the term "Core" whilst the EFI commands 
generally use the term "Root Cell". 

Each Cell board has an RJ45 connector situated in the middle of the Cell that can have a 
debugger attached to it. However, for partitions that have more than one Cell configured, the 
debugger cable must be attached to the RJ45 connector located on the Core/Root cell, and as 
such the hardware location of that Cell must be determined. 

The following procedure explains how to determine the Root/Core Cell to attach the 
debugger at the EFI Shell. Unfortunately, this means the Operating System must be down. An 
alternative to the procedure is listed in Appendix D, which allows the Operating System to 
remain up, but is much more complex. Due to the very small time window needed to execute 
this step at EFI, HP recommends completing this procedure at EFI since the Operating 
System must come down for the step afterwards. 

To identify the Core/Root cell, you must use the EFI command "rootcell". This command can 
be executed once the option "EFI Shell" is selected at the Boot Control Manager. 

Below is an example of the output: 

fsl:\> rootcell 
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Preferred Cab/ 

Root Cell Slot Warnings 



0 0/0 

The current root cell is 0 . 

From the above example we know that Core/Root cell is Cell 0, or physically the top-most 
Cell. 

Enabling the Kernel Debugger Port for rx7620 and rx8620 

The utility KD.EFI is needed in addition to the standard operating system enabling of the port 
(with the use of BOOTCFG). The "kd" utility has two options: "-on" and "-off". To enable 
the port for Windows debugging, the option "-on" must be executed at the EFI shell. Example 
output is shown below. 

Shell> kd -on 



KD Kernel Debug Port Enabler 



The KD port has been turned ON 

Any changes to the KD port will remain persistent across reboots 
and power down, as long as power is supplied to the server. 

Shell> 

Now, the shared port on the Root/Core Cell will be enabled for Windows Kernel Debugging. 

The state of the port is persistent across reboots. Use of "kd -off" from the EFI shell to 
manually disable the debug port and return the system to its default state. 

Removing power to the system reverts the debug port to its default state. This step has to be 
repeated any time the server's power is removed or lost. 

To find out if Windows Debugging is enabled on the Root/Core Cell, simply type "kd" 
without any options and the current configuration of the Debug port is displayed. 

Enabling the Kernel Debugger Port for rx4640 

The HP Integrity rx4640 server has 3 DB9 connectors on the rear I/O panel. The connector 
labeled "remote" (the one closest to the VGA connector) is used as the Windows kernel 
debug port, but it is not enabled by default. 

To enable the debug port you will have to physically open the server' s I/O bay and short a 
jumper header (jumper not provided). 
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1. Ensure that the system is powered off and disconnected from the AC mains. 

2. Locate a set of 3 jumpers directly above the brown edge connector socket (resembles an 
AGP slot) on the motherboard (Fig. 3). 

3. Short the middle jumper header labeled "console mux". 

4. Power on the server. The "remote" DB9 port can now be used as a debug port with a 
DB9 Female-terminated RS-232 Null Modem Cable. 




Figure 3. Location of a group of 3 jumpers on the rx4640 main board. 



How to Install and Run the Microsoft Debugger 

For additional information go to the Microsoft website at: 
http://www.microsoft.com/whdc/ddk/debugging/default.mspx 

Refer to the debugger documentation for setting up a kernel debug client. Ensure that the 
debugger's baud rate matches the one specified in the boot loader options. 
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Appendix A: Debug Port Locations 




**••• 




^ SCSI LVD/SE 





Figure 4. Location of debug port on rx2600 server. 




Figure 5. Location of debug port on rx4640 server. 





Figure 6. Location of RJ45 debug port on the rx5670 server. 
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Figure 7. Location of RJ45 debug port on a Superdome server Cell(s). 

Note: There are 2 orientations in which the HP Integrity Superdome cells may be installed. 
Figure 7 shows 2 adjacent cells and the kernel debug ports on each. Always make sure to use the 
RJ-45 connector closest to the handle. Of course, there will be only one active debug port for a 
given partition that may span 1 or more non-consecutive cells. The cell containing the debug port 
will be the root/core cell. For discussion on root cells please refer to previous sections or 
Appendix D. 

For HP Integrity rx7620 and rx8620 server debug ports, please see Appendix D, Fig. 8. There 
will be only one RJ45 connector to chose from. Other rules conform to those of the Superdome. 
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Appendix B: Debug Port Adapter Pin Out 



HP Integrity servers rx2600 and rx4640 only require a DB9 Female-terminated RS-232 Null 
Modem Cable.. Refer to the next section for adapter configuration for the other integrity 
servers. 

The kernel debug ports of the HP Integrity rx5670, rx7620/rx8620 and Superdome servers 
require an RJ45 -terminated CAT-5 cable connected to the root cell of the partition under 
debug and a DB9 to RJ45 adapter. 

The Pin Out for the HP Integrity rx5670, rx7620/rx8620 and Superdome kernel debug port 
adapters are shown in the tables below. 



HP Integrity Superdome Kernel Debug Port Adapter Pin Out 


RJ45 Receptacle Pin 


Wire Color 


DB9 Female Pin 


1 


Blue 


7 


2 


Orange 


5 


3 


Black 


NC 


4 


Red 


8 


5 


Green 


3 


6 


Yellow 


NC 


7 


Brown 


2 


8 


Gray (White) 


NC 



HP Integrity server rx8620/rx7620 Kernel Debug Port Adapter Pin Out 


RJ45 Receptacle Pin 


Wire Color 


DB9 Female Pin 


1 


Blue 


4 


2 


Orange 


8 


3 


Black 


5 


4 


Red 


3 


5 


Green 


2 


6 


Yellow 


NC 


7 


Brown 


7 


8 


Gray (White) 


6 
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HP Integrity server rx5670 Kernel Debug Port Adapter Pin Out 


RJ45 Receptacle Pin 


Wire Color 


DB9 Female Pin 


1 


Blue 


1 


2 


Orange 


3 


3 


Black 


2 


4 


Red 


4 


5 


Green 


5 


6 


Yellow 


6 


7 


Brown 


7 


8 


Gray (White) 


8 
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Appendix C 



Enabling Live Debug with the Operating System Down (optional procedure to 
Enabling Live Debug in the OS) 

1. From the EFI Shell, go to the MSUTIL directory and execute the NVRBOOT.EFI 
command. 

fsl:\> dir 
Directory of: fsl:\ 

03/25/03 05:00a 
06/25/03 11:14a 
06/25/03 11:14a 

2 Filets) 

2 Dir(s) 

fsl:\> cd msutil 
fsl:\MSUtil> nvrboot 

2. Select M(Modify) to modify the OS boot loader. 
Select> m 

3. Enter OS boot option to modify. 
Enter OS boot option to modify: 1 

4. Enter VAR to modify: 2 

1 Loadldentifier = Windows Server 2003, Datacenter 

2 OsLoadOptions = /REDIRECT /NOVESA 

3 EfiOsLoaderFilePath = cf5f2ddc-b885-l Id7-b83 1-000000000000 :: 
\efi\microsoft\winnt50\ia641dr.efi 

4 OsLoaderFilePath = e605a034-b885-l Id7-b83 1-000000000000 :: Windows 
Enter var to modify: 2 

5. Retype OsLoadOptions with the /DEBUG /BAUDRATE= 115200 option. 
Enter var to modify: 2 

OsLoadOptions = /REDIRECT /NOVESA /DEBUG /BAUDRATE=1 15200 

NOTE: The /NOVESA switch is only needed for systems that have a VGA card installed in the partition, 
otherwise this option may not be present. 



841,216 SETUPLDR . EFI 

<DIR> 1,024 EFI 

<DIR> 1,024 MSUtil 

841,343 bytes 
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6. The /DEBUG /BAUDRATE=1 15200 is now in the OsLoadOptions. 

1 Loadldentifier = Windows Server 2003, Datacenter 

2 OsLoadOptions = /REDIRECT /NO VESA /DEBUG 
/BAUDRATE=1 15200 

3 EfiOsLoaderFilePath = cf5f2ddc-b885-l Id7-b83 1-000000000000 :: 
\efi\microsoft\winnt50\ia641dr.efi 

4 OsLoaderFilePath = e605a034-b885-l Id7-b83 1-000000000000 :: Windows 

7. Exit and boot the OS. 



Please note after completing live debugging, "/DEBUG" and "/BAUDRATE=1 15200" 
should be removed from the OsLoadOptions path, and the system rebooted in order for 
Windows 2003 to initialize without extra debugging options. It is standard practice to remove 
debug options from the boot configuration once debugging is finished. 
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Appendix D 



Determining the Root/Core Cell on the HP Integrity rx7620, rx8620, and 
Superdome Servers 

The terms "Core Cell" and "Root Cell" are synonymous with each other. The Partitioning 
Commands that are part of the ParCli product use the term "Core" while the EFI commands 
generally use the term "Root Cell". The following section explains how to determine the Core 
Cell with the Operating System running. This procedure requires many more steps than the 
previous "Determining the Root/Core Cell" procedure described on page 12. 

The sxlOOO-based HP Integrity servers are multi-partition servers, and as such can have 
multiple Cells in a partition. If a partition has more than one cell, then only one will be the 
"Core" cell with all others being termed a "Base" cell. For every partition on a system (often 
termed a "Complex") there will be one Core Cell. Due to this it is assumed that the Partition 
Number or friendly name is already known for the OS instance that needs to be debugged. 

To determine the Core Cell please use the following rules: 

If the partition has only one Cell, it must be the Core Cell. 

If the partition has more than one Cell, but only one I/O Chassis within the partition, then 
Cell with the I/O chassis will be the Core Cell. 

If the partition has more than one Cell and more than one I/O Chassis then the following 
procedure can be used to determine the Core Cell. The following procedure can be used if the 
answers to the above statements are not known. 

Prerequisites for Procedure 

The IPMI Password is known for the HP Integrity sxlOOO server. For more information on 
configuring the IPMI Password please review the "ParCLI nPartition Management" Manual 
available on the Smart Setup CD or at http://www.hp.com/. 

A laptop or workstation is available and has Partition Manager Command Line Interface 
(ParCLI) installed on it. For more information on ParCLI please review the "ParCLI 
nPartition Management" Manual available on the Smart Setup CD or at http://www.hp.com/. 

The IP Address or Hostname for the server' s Management Processor (MP) is known. 

The laptop or workstation is placed on a network that can connect to the Management 
Processor over the LAN. 

Use PARSTATUS to determine Core Cell. 

If the above prerequisites are known then the PARSTATUS command can be issued from the 
command line with the following syntax. 
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Parstatus -g ipmipassword -h ManagementProcessorAddress 



The command may take up to 2 minutes to complete. Once it has completed the last block of 
text is needed to determine the Core Cell for the partition. The text lists the Partitions on the 
Complex, and also the hardware address of the Core Cell. The following text shows an 
example of the output. 

[Partition] 

Par # of # of I/O 

Num Status Cells Chassis Core cell Partition Name (first 30 chars) 



0 Active 2 2 cabO, cellO RX8620-00 11.23 

1 Active 2 2 cabO,celll RX8620-01 Windows 2003 



The above output shows two partitions (determined by Par Num column) and for Par Num 0 
the Core Cell is "Cab 0, Cell 0", and for Par Num 1 the Core Cell is "Cab 0, Cell 1". 

In this rx8620 example, if the OS instance that needs to be debugged is Par Num 1, then the 
RJ45 connector must be connected to "Cell 1". 
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